Splunk Search

splunk query with specific product id count

freephoneid
Path Finder

Hi,

My log contains below entries:

activated=true productid=8432 userid=123 email=abc@abc.com
activated=false productid=8432 userid=2123 email=12@a212bc.com
activated=true productid=3422 userid=434123 email=pqe@dfd.com
activated=true productid=433232 userid=7468 email=434@a43433c.com

I want to find the count for all those users who have activated=true and whose productids are not 645,423,433232,7483,57893,45673,847832,48832,4323,432,3323,323,12,233,234545,2323

Can any one provide me the query for the same?

Thanks

Tags (3)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
activated=true NOT productid=645 NOT productid=423 NOT productid=433232 NOT productid=7483 ... | stats count

View solution in original post

0 Karma

gooza
Communicator

use lookup tables , list the product id you're looking for in csv and add a seen field to it:

productid,seen

645,1

423,1
and so on

then run the search

activated=true | lookup yourlookuptable productid OUTPUT seen | Where seen!=1

you can read more on lookup tables at:

docs.splunk.com

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
activated=true NOT productid=645 NOT productid=423 NOT productid=433232 NOT productid=7483 ... | stats count
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

if you look at gooza's answer, you can do it with a lookup table. it's actually better (much better) with a subsearch and a lookup definedd like he has, and then doing:

activated=true NOT [ inputlookup yourlookuptable | return 10000 productid ] | stats count

which will work with up to 10000 productids.

0 Karma

freephoneid
Path Finder

Hi gkanapathy....The product id list is more than 30...Is there another way to implement this query?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...